AuditLogPage

Shape

• recordsarray of AuditRecord

  • The AuditRecord schema
  • actorAuditActor

    • The AuditActor schema
    • actor_typestringWhat kind of caller acted: user, service_account, pipeline_run, anonymous, or scim — an organization's identity provider calling with its SCIM token.
    • auth_methodAuthMethodjwtaccess_tokenanonymousHow the caller authenticated.
    • idstringThe id of the user, service account or pipeline run that acted, or anonymous.
    • avatar_urlstring or nulloptional
    • emailstringoptional
    • token_idstring or nulloptional
    • usernamestringoptional
  • audit_idAuditId (string · uuid)
  • categoryAuditCategorymutationauth_eventsensitive_readWhat kind of operation the record captures.
  • hashstringSHA256(canonical_json(record without hash) ‖ prev_hash), hex.
  • http_methodstring
  • monthstringThe month the record belongs to, YYYY-MM. Each month's records form one segment of the chain.
  • occurred_atstring
  • operation_idstring
  • outcomeAuditOutcomesuccessdeniedfailureThe result of the audited operation.
  • prev_hashstringHash of the previous record in the chain (genesis = 64 zeros; first of a month links to the prior month's tip).
  • recorded_atstringWhen the record was written to the log, RFC 3339 with microseconds.
  • request_idstring
  • routestring
  • scopestringWhich audit chain the record belongs to — an organisation, a user, or the platform.
  • seqinteger · int640–∞Monotonic position within (scope, month).
  • status_codeinteger · int320–∞
  • accessAccessAuditDetail or nulloptionalFor an operation that changed who can do what: each grant it made, changed or revoked, with the role before and after. Absent everywhere else — and absent fields do not enter the hash, so every record written before this field existed verifies unchanged.

    • The AccessAuditDetail schema
    • changesarray of AccessAuditChange

      • The AccessAuditChange schema
      • grant_idGrantId (string · uuid)
      • scopeScopeRef
      • sensitivebooleanWhether either role carries a sensitive or reserved permission.
      • subjectSubjectRef
      • afterRoleRef or nulloptionalThe role after the change. Absent for a revoked grant.
      • beforeRoleRef or nulloptionalThe role before the change. Absent for a new grant.
    • inheritanceInheritanceAuditChange or nulloptionalA scope's inheritance switched.

      • The InheritanceAuditChange schema
      • inherits_accessboolean
      • scopeScopeRef
    • limitLimitAuditChange or nulloptionalA limit set or removed.

      • The LimitAuditChange schema
      • ceilingCeilingRef
      • limit_idLimitId (string · uuid)
      • scopeScopeRef
      • setbooleantrue when the limit was set, false when it was removed.
      • subjectLimitSubjectRef
    • roleRoleAuditChange or nulloptionalA custom role's permissions changing — which changes access wherever the role is granted, without any grant changing.

      • The RoleAuditChange schema
      • grants_affectedinteger · int64
      • limits_affectedinteger · int64
      • permissions_addedarray of string
      • permissions_removedarray of string
      • role_idRoleId (string · uuid)
  • mcpMcpAuditDetail or nulloptionalFor a request an AI agent made through the MCP server: the tool and the client. Absent everywhere else, and so outside the hash of every record that does not carry it.

    • The McpAuditDetail schema
    • toolstringThe tool whose execution made the request.
    • clientstring or nulloptionalThe client application the tool call came from, as that application named itself.
    • oauth_client_idstring or nulloptionalThe app the access token was issued to, when an app connected through sign-in — its own registered identifier, which, unlike the self-reported client name, the person consented to.
  • resource_bindingstring or nulloptional
  • source_ipstring or nulloptional
  • target_idstring or nulloptional
  • target_typestring or nulloptional
  • user_agentstring or nulloptional
• next_cursorstring or nulloptional

Graph

Used by